Data PRIVACY POLICY

The protection of your personal data and privacy is important to our organizations and is taken into consideration in all our processes. This privacy policy tells you what we do with your personal data, when you visit our project website, register for our newsletter, contact us via e-mail or interact with one of our social media accounts.

Personal data are individual details regarding the personal or factual circumstances of a specific or identifiable natural person. This includes information such as name, address, telephone number and date of birth. Processing of your data means any use by us, such as the use, storage, deletion, or disclosure of this data.

In this data privacy statement, we will tell you

why we can process your personal data
for which purposes we are processing your personal data
how long we process and store your personal data
whether we are sharing your personal data with other recipients
whether your personal data is needed e.g., using one of our services
whether we intend to transfer your personal data into third countries

We segmented our data privacy statement into different parts. At first, we will give you general information on how we are processing personal data that applies for every processing we conduct. In the second part, we will provide you information on the following processing situations:

When you are a visitor of our website
When you register for our newsletter
When you are contacting us
When you are interacting with one of our social media accounts

1. Controller

The SchoolFood4Change Project is a joint project of ICLEI, WWF Germany and WWF Sweden. Therefore, theses parties act as joint controllers, as we are jointly defining the means and purposes of the processing of your personal data connected to our website, newsletter and social media presences. The mentioned parties have concluded a joint controllership agreement, which defines the responsibilities of each party.

WWF Germany
A Civil Law Foundation
Reinhardtstr. 18
10117 Berlin
GERMANY
Phone: +4930 311777-0
Fax: +4930 311777-199
E-Mail: info(at)wwf.de

Stiftelsen Världsnaturfonden WWF
Ulriksdals slott,
Slottsallén 1, 170 79 Solna
SWEDEN
Phone: +468 624 74 00
E-Mail: info(at)wwf.se

ICLEI European Secretariat GmbH
Leopoldring 3,
79098 Freiburg im Breisgau
GERMANY
Phone: +49761 368920
Fax: +49 61 36 89 2-19
E-Mail: iclei-europe(at)iclei.org

2. Data Protection Officer

If you have any questions regarding the processing of your personal data, you can contact our Data Protection Officer in writing.

WWF Germany
Data Protection Officer
Reinhardtstr. 18
10117 Berlin
Phone: 030 311777-0
datenschutz(at)wwf.de

ICLEI European Secretariat GmbH Christian Dicken Faulerstr. 12 79098 Freiburg Phone: +49 761 6309682 c.dicken(at)support-it.de

3. Legal Basis for the Processing of Personal Data

In the following section, we want to provide an overview about the legal basis for the processing of personal data under the GDPR. If we rely on legal bases outside the GDPR for processing, like country specific data privacy legislation, we will inform you accordingly.

Consent (Art. 6 (1)(a) GDPR):
The data subject has given his/her informed and voluntary consent to the processing of his/her personal data;
Fulfilment of contract and pre-contractual inquiries (Art. 6 (1)(b) GDPR):
The processing of the personal data is necessary for the fulfilment of a contract between the controller and the data subject, or conducting pre-contractual actions to conclude a contract;
Legal obligation (Art. 6 (1)(c) GDPR):
The processing of the personal datais necessary to fulfil a legal obligation the controller is obligated;
Legitimate interest (Art. 6 (1)(f) GDPR):
The processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

Besides the above stated regulations, the national data privacy legislation of Germany applies. This particularly applies for the Federal Data Protection Law (BDSG) and the German Telecommunications-Telemedia Data Protection Act (TTDSG).

4. Duration of Processing or Storage of Your Personal Data

Your personal data will be deleted as soon as the purpose required for processing has been fulfilled. Different retention periods may apply due to legal requirements.

5. Transfer of Personal Data / Third Parties

In general, your personal data is only processed between the joint controllers and not shared with third parties. In some cases, it may be necessary to share your personal data with associated companies or service providers. In such cases, we have concluded data processing agreements (Art. 28 GDPR) or joint controllership agreements (Art. 26 GDPR) to ensure the lawfulness of the transfer and secure your personal data.

In some cases, your personal data may be transferred outside of the European Economic Area, where the GDPR applies (so-called transfer into a third country). If we conduct such a transfer, we ensure that there is an adequate level of data protection in place by making sure that at least one of the following safeguards is in place:

Adequacy Decision of the European Commission according to Art. 45 GDPR that there is an adequate level of data privacy in the target country of the transfer.
The conclusion of so-called Standard Contractual Clauses (SCC) that have been approved by the EU Commission in accordance with Art. 46 GDPR.
The presence of Binding Corporate Rules (BCR), which were approved by an EU, based supervisory authority after Art 47 GDPR.

We would like to inform you that we might be legally obliged to disclose personal data to authorities under certain circumstances. Depending on the legal reason we may be not allowed to inform you about the disclosure. The legal basis for the data transfer to third parties is generally Art. (1) (c) GDPR. In individual cases, Art. 6 (1) (a) GDPR (when giving consent) or Art. 6 (1) (b) GDPR (for the performance of a contract) may also be relevant. Should a transfer take place in the context of legitimate interest, Art. 6 (1) (f) GDPR is the relevant legal basis in this case.

6. Your Rights as a Data Subject

Under the GDPR, you have rights, which are defined in Art. 15 to 21 GDPR. You can exercise these rights with no additional cost.

Right of access:
You have the right to request information about to request information about whether we process personal data about you and to request a copy of the personal data we process.
Right to rectification
You have the rightto rectify personal data of which you think is inaccurate or incomplete.
Right to erasure
You have the right to request us to eraseyour personal data in some cases.
Right to restrict processing
You have the right to request us to restrict the processing of personal data in some cases.
Right to data portability
You have the right to request us if we transfer personal data you provided to us to another organisation. This doesn’t apply in certain cases.
Right to withdrawal of consent:
When you have given us a consent to process your personal data you can withdraw your consent anytime without having to fear negative effects. However, the withdrawal does not affect the lawfulness of the processing carried out until the withdrawal.
Right to object to processing
In the case that we are relying our processing of your personal data on our legitimate interest (Art. 6 (1)(f) GDPR) you have the right to object to the processing on grounds relating to your situation.

If you think that, the processing of your personal data violates the GDPR you furthermore have the right to lodge a complaint with a supervisory authority. You can lodge this complaint to the authority in the member state of your habitual residence, place of work or the place where an alleged incident occurred in your opinion.

You can refer to the list of supervisory authorities of the European Data Protection Board to find the contact information of the corresponding authority:

https://edpb.europa.eu/about-edpb/about-edpb/members_en

The responsible supervisory authority for WWF Germany is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin
E-Mail: mailbox(at)datenschutz-berlin.de

The responsible supervisory authority for WWF Sweden is:

Integritetsskyddsmyndigheten Box 8114 10420 Stockholm E-Mail: imy(at)imy.se

The responsible supervisory authority for ICLEI European Secretariat GmbH is:

Der Landesbauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg Lautenschlagerstraße 20, 70173 Stuttgart Postfach 10 29 32 E-Mail: poststelle(at)lfdi.bwl.de

7. Processing of Personal Data

7.1. Data Security on Our Websites

To protect your personal data when you visit our website, we’re using SSL/TLS encryption on all sub-pages to prevent manipulation, sniffing or similar unauthorised data processing especially on transit. You can recognize the encrypted connection by the lock symbol next to the address bar of your browser

The primary active joint controller concerning this data processing is WWF Germany.

7.2. Data Processing on Our Website

In general, you can use our website without having to provide us with personal data, beyond such data necessary for technical operation of the website or data you provide us in forms or similar occasions.

We (or our web hosting provider) collect data on every access to the server (so-called server log files) your browser is providing to us.

No usage profiles are created in which this information and other personal data are linked. We also shorten the last three digits of your IP-address to prevent the possibility to identify the used internet access.

The primary active joint controller concerning this data processing is WWF Germany.

Categories of personal data	– Meta data (e.g., IP-Addresses) – Location data (e.g., approximate location based on IP-address) – Device information (e.g., installed fonts on the device or screen resolution) – Usage information (e.g., previously visited Websites through a Referrer URL)
Purpose of the processing	– Technical provision of the contents – For the identification and tracking of unauthorised access attempts/accesses to the web server to ensure the security and stability of our system – Statistical evaluations such as visitor numbers and page popularity
Legal basis	– Art. 6 (1)(f) GDPR. Our legitimate interest lies in the uninterrupted provision of the website content and the prevention of unauthorised access. – Art. 6 (1)(b) GDPR if the visit is in connection with an existing contractual relation or in a pre-contractual setting.
Data subjects affected	Visitors of the SchoolFood4Change Website
Recipients or categories of recipients	– IT service provider – Hosting provider: Brandung GmbH & Co. KG,Leuschnerdamm 13, 10999 Berlin – Website implementation agency: giftGRÜN GmbH, Pascalstraße 6, 52076 Aachen

8. Use of Cookies and Third Party Tools

We use cookies on our websites to ensure you have an optimal website experience. This allows us to make our website work, more user-friendly and effective, save preferences of visitors, conduct marketing activities, measure our website traffic, and implement security features.

Cookies are small text files that are stored on your terminal device by our web application, and which enable us to recognise your internet browser. The most common internet browsers are set to automatically accept cookies. However, you can deactivate this or set your internet browser so that it informs you about the use of cookies. Please note that the functionality of our website can be impaired when you deactivate cookies in your browser.

In general, there are two different kinds of cookies:

Session Cookies:
Are only saved on your device until you close your current browser session.
Permanent Cookies:
Are saved on your device until the defined period is reached or you delete them. If not stated otherwise users should assume that the cookie permanent cookie.

The primary active joint controller concerning this data processing is WWF Germany.

8.1. Legal Basis for the Use of Cookies

Regarding the legal basis for the use of cookies there has to be differentiated between technical necessary cookies and those which are not technical necessary.

Technically necessary cookies are cookies that are needed for the website to function and cannot be deactivated in your systems. Generally, these cookies are only set in response to actions you take that correspond to a request for service, such as setting your cookie preferences, logging in or completing forms.

Type of Cookie	Legal basis
Technically necessary cookies	– § 25 (2) TTDSG for saving the cookie on your device and reading the saved cookie on a later visit. – Art. 6 (1)(f) GDPR for any further processing as it is our legitimate interest to provide you our website as some features or technical functions are not possible without using cookies like saving your consent into setting cookies.
Other cookies	– § 25 (1) TTDSG Your consent for saving the cookie on your device and reading the saved cookie on a later visit. – Art. 6 (1)(a) GDPR Your consent for any further processing, like tracking or website analysis.

8.2. Cookies We Use

We are currently only the following technically necessary cookies:

Cookie	Type	Purpose	Duration of storage
Users Cookie	Permanent	Technically necessary for the login into the WordPress administration and user backend of the website	15 days

8.3. Matomo

We use the web analytics tool Matomo for statistical data collection. The creation of this evaluation is based exclusively on the log files described under 7.2. No cookies are set.

Data protection-friendly settings are made to prevent the processing of personal data. The IP address is shortened accordingly.

If applicable the legal basis for the processing is Art. 6 (1) (f) GDPR. The processing of personal data enables us to analyze the usage behavior of website visitors. By evaluating the data obtained, we are able to compile information about the use of the individual components of our websites. This helps us to continuously improve our websites and their user-friendliness. By anonymizing the IP address, the interest of users in the protection of their personal data is sufficiently taken into account.

9. Processing of Personal Data When You Are Subscribing to Our Newsletter

We offer the possibility to subscribe to our newsletter, which informs about latest developments in the SchoolFood4Change project, distributes results and publications of the project and informs about topics relevant for actors in the school food system

Subscription to our newsletter is conducted via a so-called double opt-in. This means that you will receive an e-mail following the subscription in which you will be asked to confirm your subscription. The reason for this is to ensure that nobody registers an e-mail-address, which belongs to another person.

You can revoke your consent at any time without giving reasons. You can send an informal revocation either via the unsubscribe link in each newsletter or by sending an e-mail to info(at)wwf.de or in writing to WWF Germany Reinhardstr. 18, 10117 Berlin, Germany.

To provide you with this service we are using we use the service provider Mailchimp [PD1] [AR2] [PD3] (The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, United States of America). The Rocked Sience Group is a US-based service provider, which means that when you are using the newsletter service your personal data will be transferred to a third country. To ensure an adequate level of data privacy we have concluded Standard Contractual Clauses with the Rocket Science Group.

The primary active joint controller concerning this data processing is WWF Germany.

Purpose of the processing	Informing interested parties about our project and actual developments
Categories of personal	E-mail address
Legal basis	Art. 6 (1)(a) GDPR. Your consent via a double-opt-in into receiving the newsletter.
Data subjects affected	Interested persons regarding the newsletter
Recipients or categories of recipients	The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, United States of America
Country of possible recipients	USA
Privacy Policy	https://mailchimp.com/legal/
Data Processing Agreement	https://mailchimp.com/de/legal/data-processing-addendum/
Duration of processing or storage	Your personal data will be deleted as soon as you unsubscribe from the newsletter.

10. Processing of Personal Data When You Are Contacting Us

When you are contacting us via the provided e-mail address info(at)schoolfood4change.eu personal data is processed. The data entered will be transmitted to the WWF Germany and WWF Sweden.

The primary active joint controller concerning this data processing is ICLEI European Secretariat and WWF Sweden.

Purpose of the processing	Handling of the contact request
Categories of personal data	– Contact information (e.g., first, or last name, e-mail address) – Message content
Legal basis	– Art. 6 (1)(f) GDPR Our legitimate interest consists in the proper processing of the contact. – Art. 6 (1)(b) GDPR if the contact to us is in connection with an existing contractual relation or in a pre-contractual setting
Data subjects affected	Persons who are contacting us
Recipients or categories of recipients	– Hosting provider: Brandung GmbH & Co. KG,Leuschnerdamm 13, 10999 Berlin – Mail provider
Duration of processing or storage	Your personal data will be deleted as soon as the purpose of the communication has been fulfilled. Different retention periods may apply due to legal requirements. If the communication can be deemed a business correspondence, we are obliged by the German commercial code to retain the communication for at least 6 years. If the communication is tax related the German Tax Code requires us to retain the data for 10 years.

11. Processing of Personal Data of Social Media Users

We maintain publicly accessible profiles on various social networks. As the operator of theses presences on the social media platforms we are processing personal data, for example, if we are communicating with you via the platforms or posting content and you interact with this content. Furthermore, we can access personal data you have publicly available on your social media profile.

In the case you are visiting one of our social media profiles your personal data is also processed by the social media platforms themselves. This applies even if you do not have a profile on the certain social media platform. The specific data processing operations and their extent differ depending on the operator of the respective social media platform and we have no influence regarding this processing by the platforms. More information regarding the processing of personal data through the social media platform can be found in their respective privacy statement.

For most social media platforms it cannot be ruled out that a processing personal data is also taking outside of the European Union/European Economic Area. This means that a transfer of personal data into third countries without an adequate level of data privacy is possible and that there are possible difficulties regarding the enforcement of the rights of the data subject.

The primary active joint controllers concerning this data processing are ICLEI European Secretariat and WWF Sweden.

We maintain profiles on the following social media platforms:

Twitter
YouTube

11.1. Twitter

We are using Twitter, a platform of the Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland to inform you about the latest developments and information about our project.

As mentioned above, social media platforms like Twitter are conducting their own processing of your personal data on their own without any influence from our site.

Data processing of the joint controllers:

We are processing your personal data in the following way when you are using Twitter:

Purpose of the processing	– Marketing – Communication with users (e.g., via direct message or interaction on our Twitter posts)
Categories of personal data	– Publicly available information from your profile (e.g., your username, content of your bio) – Content data (e.g., content of a direct message or interaction with our posts) – If applicable meta/location data (e.g., if you include your location into a post on Twitter)
Legal basis	– Art. 6 (1)(f) GDPR Our legitimate interest to inform the public about our company and to communicate with parties who are interested in our project. – Art. 6 (1)(a) GDPR Consent regarding personal data you provide us voluntarily
Data subjects affected	– Users of Twitter – Unregistered users who visit our profile or tweets
Recipients or categories of recipients	Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland
Country of possible recipients	A transfer into third countries like the USA cannot be ruled out.
Duration of processing or storage	Your personal data will be deleted as soon as the purpose required for processing has been fulfilled. Different retention periods may apply due to legal requirements.

Regarding the above-described data processing Twitter is acting as our processor. We have concluded a data processing agreement in accordance with Art. 28 GDPR. This agreement can be found here: https://privacy.twitter.com/en/for-our-partners/global-dpa The data processing agreement has also incorporated the Standard Contractual Clauses to provide an adequate level of data privacy in case your personal data in transferred into a third country.

Data Processing of Twitter

Twitter processes your personal data in different ways for different purposes on various legal basis. This includes also tracking an analysing your usage of Twitter. For further information how Twitter is processing your personal data if you are using it, please refer to their privacy statement: https://twitter.com/en/privacy.

Twitter gives you a certain amount of control regarding their processing of personal data. For more information on this us the following link: https://twitter.com/settings/account/personalization.

11.2. YouTube

We are using YouTube, a platform of the Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland to provide you videos about our project.

As mentioned above social media platforms like YouTube are conducting their own processing of your personal data on their own without any influence from our site.

Data Processing of the Joint Controllers:

We are processing your personal data in the following way when you are using YouTube:

Purpose of the processing	– Marketing – Communication with users (e.g., via interactions under our YouTube Videos)
Categories of personal data	– Publicly available information from your profile (e.g., your username, content of your bio) – Content data (e.g., interaction with our videos) – If applicable meta/location data (e.g., if you include your location into a post on Twitter)
Legal basis	– Art. 6 (1)(f) GDPR Our legitimate interest to inform the public about our company and to communicate with parties who are interested in our project. – Art. 6 (1)(a) GDPR Consent regarding personal data you provide us voluntarily
Data subjects affected	– Users of YouTube – Unregistered users who visit our profile or watch our videos
Recipients or categories of recipients	Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland
Country of possible recipients	A transfer into third countries like the USA cannot be ruled out.
Duration of processing or storage	Your personal data will be deleted as soon as the purpose required for processing has been fulfilled. Different retention periods may apply due to legal requirements.

Data Processing of YouTube

Google processes your personal data in different ways for different purposes on various legal basis. This includes also tracking an analysing your usage of YouTube. For further information how Google is processing your personal data if you are using it, please refer to their privacy statement: https://policies.google.com/privacy

Google provides the possibility to control how your personal date is processed: https://adssettings.google.com/authenticated

12. Contact

If you have any questions or suggestions regarding data protection in general or our Data Privacy Policy, please contact WWF Germany’s Data Protection Officer by e-mail.

Last updated

30.06.2023

MATOMO TRACKING

You may choose to prevent this website from aggregating and analyzing the actions you take here. Doing so will protect your privacy, but will also prevent the owner from learning from your actions and creating a better experience for you and other users.